CVE-2026-40930 Details

A chunk-smuggling vulnerability has been identified in the push-mode APNG parser of libpng version 1.8.0. This issue arises from three inter-frame chunk discard paths that clear the chunk-header flag without properly consuming the chunk body and CRC. As a result, attacker-controlled bytes within an ignored ancillary chunk can be misinterpreted as a new chunk header during the next call to 'png_process_data'. The vulnerability allows smuggled data to reach the APNG sequence counter and the zlib decompressor, where it is decoded as frame pixel data. While this does not lead to code execution, it allows for the manipulation of rendered images. The vulnerability is present in downstream applications that use the libpng-apng patch, including Firefox, Thunderbird, and several Linux distributions. The impact varies depending on the application's CRC error handling configuration, with the default setting causing a denial-of-service by rejecting the malformed data, and a relaxed setting allowing the smuggled data to be processed as image content.

The vulnerability has been fixed in the libpng18 development branch at commit 'faf06924688b62d7c1654b5ceddedbde66ffadb4'. Downstream consumers of the libpng-apng patch applied to libpng 1.6.x should update to libpng-1.6.57-apng.patch v2 or libpng-1.6.58-apng.patch, both available on SourceForge. Those using Firefox or Thunderbird should ensure they are on a version that includes the patched libpng.